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Introduction 

0.1 General 

The adoption of a quality management 
system is a strategic decision for an 
organization that can help to improve its 
overall performance and provide a sound 
basis for sustainable development initiatives. 
The potential benefits to an organization of 
implementing a quality management system 
based on this International Standard are: 

a) the ability to consistently provide products 
and services that meet customer and 
applicable 

statutory and regulatory requirements; 

b) facilitating opportunities to enhance 
customer satisfaction; 

c) addressing risks and opportunities 
associated with its context and objectives; 

d) the ability to demonstrate conformity to 
specified quality management system 
requirements. 

This International Standard can be used by 
internal and external parties. 

It is not the intent of this International 
Standard to imply the need for: 

— uniformity in the structure of different 
quality management systems; 

— alignment of documentation to the clause 
structure of this International Standard; 

— the use of the specific terminology of this 
International Standard within the organization. 
The quality management system 
requirements specified in this International 
Standard are complementary to requirements 
for products and services. 

This International Standard employs the 
process approach, which incorporates the 
Plan-Do-Check-Act (PDCA) cycle and risk- 
based thinking. 

The process approach enables an 
organization to plan its processes and their 
interactions. 

The PDCA cycle enables an organization to 
ensure that its processes are adequately 
resourced and managed, and that 
opportunities for improvement are determined 
and acted on. 

Risk-based thinking enables an organization 
to determine the factors that could cause its 
processes and its quality management 
system to deviate from the planned results, to 
put in place preventive controls to minimize 
negative effects and to make maximum use of 
opportunities as they arise (see Clause A.4). 
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Consistently meeting requirements and 
addressing future needs and expectations 
poses a challenge for organizations in an 
increasingly dynamic and complex 
environment. To achieve this objective, the 
organization might find it necessary to adopt 
various forms of improvement in addition to 
correction and continual improvement, such 
as breakthrough change, innovation and re¬ 
organization. 

In this International Standard, the following 
verbal forms are used: 

— “shall” indicates a requirement; 

— “should” indicates a recommendation; 

— “may” indicates a permission; 

— “can” indicates a possibility or a capability. 

Information marked as “NOTE” is for guidance 
in understanding or clarifying the associated 
requirement. 

0.2 Quality management principles 

This International Standard is based on the 
quality management principles described in 
ISO 9000. The descriptions include a 
statement of each principle, a rationale of why 
the principle is important for the organization, 
some examples of benefits associated with 
the principle and examples of typical actions 
to improve the organization’s performance 
when applying the principle. 

The quality management principles are: 

— customer focus; 

— leadership; 

— engagement of people; 

— process approach; 

— improvement; 

— evidence-based decision making; 

— relationship management. 

0.3 Process approach 

0.3.1 General 

This International Standard promotes the 
adoption of a process approach when 
developing, implementing and improving the 
effectiveness of a quality management 
system, to enhance customer satisfaction by 
meeting customer requirements. Specific 
requirements considered essential to the 
adoption of a process approach are included 
in 4.4. 
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Understanding and managing interrelated 
processes as a system contributes to the 
organization’s effectiveness and efficiency in 
achieving its intended results. This approach 
enables the organization to control the 
interrelationships and interdependencies 
among the processes of the system, so that 
the overall performance of the organization 
can be enhanced. 

The process approach involves the 
systematic definition and management of 
processes, and their interactions, so as to 
achieve the intended results in accordance 
with the quality policy and strategic direction 
of the organization. Management of the 
processes and the system as a whole can be 
achieved using the PDCA cycle (see 0.3.2) 
with an overall focus on risk-based thinking 
(see 0.3.3) aimed at taking advantage of 
opportunities and preventing undesirable 
results. 

The application of the process approach in a 
quality management system enables: 

a) understanding and consistency in meeting 
requirements; 

b) the consideration of processes in terms of 
added value; 

c) the achievement of effective process 
performance; 

d) improvement of processes based on 
evaluation of data and information. 

Figure 1 gives a schematic representation of 
any process and shows the interaction of its 
elements. The monitoring and measuring 
check points, which are necessary for control, 
are specific to each process and will vary 
depending on the related risks. 


* I te. ; K *I3.|jsJU (^LJUaJI 

sJLa t 3 U>;11 SvLi£”c) 

JajlytJfj SJjsLccU —jLIMxII Jx jjU. ajla-t 'I 3 „U; 11 
3 .U ; t I jUttAJ (Jl L«X p,Llaxl \ —jLJUx ^rU 



—i L l IajU J —JL J .C-xi 1 

aa^aeJI 1 x2 s I Jilojl a •»" <jJij 

tU xU-Ujtil a^lal (j) ^ te.; It Ij-ixVl 

"jljxJI xlx>" * x; 

<_ 3 lx <_^x ^L*JI jjSjrtJI (Y-.T jlajl) (PDCA) 

gjlilll <Jj —9^-^; (V- • V jlajl) jCX 

—Ua (jti . aa^-> a^lal aLIx xL Jxx JI ^IjLae lx iI JuX 

:".l . lte.7t,l £tu_b 4_jj [3 jc^-3 (l 

4-9L^aJLI 4 A II a 4J Cj L JlqjlJI J! \ II (<_j 
CjLJlcjlJJ (JLjl3 J^uLx .j (t 

CjLojJjlU^ jc-LjLOj Jl taLLuJ CjLJlcjlJI 

tjfei Jx-LilJI 4 -lIq-C. 4j^ *} ( ^) J 

4_ij « a «II L&j-^LLc. 

A II Cj! 3 jlsLitcJJ Ls-lj <. iJLciej 4_t_Ux. (JSo 4-^LieJ! 



PREDECESSOR 
PROCESSES 
e.g. at providers 
(internal or external) 
at customers. 


MATTER, 
ENERGY 
INFORMATION, 
e.g. in the 
form of materials, 


MATTER, 
ENERGY 
INFORMATION. 
e.g. in the 
form of product, 


at other relevant 


resources, 


service. 


interested parties 
I_I 


requirements 

I_I 


Possible controls and 
check points to monitor 
and measure performance 


Receivers of Outputs 


SUBSEQUENT 
PROCESSES 
e.g, at customers 
(internal or external), 
at other relevant 
interested parties 


Figure 1 — Schematic representation of the elements of a single process 
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0.3.2 Plan-Do-Check-Act cycle 

The PDCA cycle can be applied to all 
processes and to the quality management 
system as a whole. 

Figure 2 illustrates how Clauses 4 to 10 can 
be grouped in relation to the PDCA cycle. 
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NOTE Numbers in brackets refer to the clauses in this International Standard. 

Figure 2 — Representation of the structure of this International Standard in the PDCA cycle 
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The PDCA cycle can be briefly described as 
follows: 

— Plan: establish the objectives of the 
system and its processes, and the 
resources needed to deliver results in 
accordance with customers' requirements 
and the organization’s policies, and identify 
and address risks and opportunities; 

— Do: implement what was planned; 

— Check: monitor and (where applicable) 
measure processes and the resulting 
products and services against policies, 
objectives, requirements and planned 
activities, and report the results; 

— Act: take actions to improve performance, 
as necessary. 

0.3.3 Risk-based thinking 

Risk-based thinking (see Clause A.4) is 
essential for achieving an effective quality 
management system. 

The concept of risk-based thinking has been 
implicit in previous editions of this 
International Standard including, for example, 
carrying out preventive action to eliminate 
potential nonconformities, analyzing any 
nonconformities that do occur, and taking 
action to prevent recurrence that is 
appropriate for the effects of the 
nonconformity. 

To conform to the requirements of this 
International Standard, an organization needs 
to plan and implement actions to address 
risks and opportunities. Addressing both risks 
and opportunities establishes a basis for 
increasing the effectiveness of the quality 
management system, achieving improved 
results and preventing negative effects. 
Opportunities can arise as a result of a 
situation favourable to achieving an intended 
result, for example, a set of circumstances 
that allow the organization to attract 
customers, develop new products and 
services, reduce waste or improve 
productivity. Actions to address opportunities 
can also include consideration of associated 
risks. Risk is the effect of uncertainty and any 
such uncertainty can have positive or 
negative effects. A positive deviation arising 
from a risk can provide an opportunity, but not 
all positive effects of risk result in 
opportunities. 
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0.4 Compatibility with other 

management system standards 

This International Standard applies the 
framework developed by ISO to improve 
alignment among its International Standards 
for management systems (see Clause A.1). 
This International Standard enables an 
organization to use the process approach, 
coupled with the PDCA cycle and risk-based 
thinking, to align or integrate its quality 
management system with the requirements of 
other management system standards. 

This International Standard relates to ISO 
9000 and ISO 9004 as follows: 

— ISO 9000 Quality management systems 
Fundamentals and vocabulary provides 
essential background for the proper 
understanding and implementation of this 
International Standard; 

— ISO 9004 Managing for the sustained 
success of an organization — A quality 
management approach provides guidance 
for organizations that choose to progress 
beyond the requirements of this 
International Standard. 

Annex B provides details of other International 
Standards on quality management and quality 
management systems that have been 
developed by ISO/TC 176. 

This International Standard does not include 
requirements specific to other management 
systems, such as those for environmental 
management, occupational health and safety 
management, or financial management. 
Sector-specific quality management system 
standards based on the requirements of this 
International Standard have been developed 
for a number of sectors. Some of these 
standards specify additional quality 
management system requirements, while 
others are limited to providing guidance to the 
application of this International Standard 
within the particular sector. 

A matrix showing the correlation between the 
clauses of this edition of this International 
Standard and the previous edition (ISO 
9001:2008) can be found on the ISO/TC 
176/SC 2 open access web site at: 
www.iso.org/td 76/sc02/public. 
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Quality management systems 

— Requirements 

1 Scope 

This International Standard specifies 
requirements for a quality management 
system when an organization: 

a) needs to demonstrate its ability to consistently 
provide product or service that meets customer 
and applicable statutory and regulatory 
requirements, and 

b) aims to enhance customer satisfaction through 
the effective application of the system, including 
processes for continual improvement of the 
system and the assurance of conformity to 
customer and applicable statutory and regulatory 
requirements. 

All requirements of this International Standard are 
generic and are intended to be applicable to all 
organizations, regardless of type, size and product 
provided. 

NOTE 1 

In this International Standard, the terms “product” or 

“service” only apply to products and services intended 

for, or required by , a customer. 

NOTE 2 

Statutory and regulatory requirements can be expressed 

as legal requirements. 

2 Normative references 

The following documents, in whole or in part, 
are normatively referenced in this document 
and are indispensable for its application. For 
dated references, only the edition cited 
applies. For undated references, the latest 
edition of the referenced document (including 
any amendments) applies. 

ISO 9000:2015, Quality management systems 

— Fundamentals and vocabulary 

3 Terms and definitions 

For the purposes of this document, the terms and 
definitions given in ISO 9000:2015 apply. 
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4 Context of the organization 

4.1 Understanding the organization and its 
context 

The organization shall determine external and 
internal issues that are relevant to its purpose 
and its strategic direction and that affect its 
ability to achieve the intended result(s) of its 
quality management system. 

The organization shall monitor and review the 
information about these external and internal 
issues. 

NOTE 1: 

Issues can include positive and negative 

factors or conditions for consideration. 

NOTE 2: 

Understanding the external context can be 

facilitated by considering issues arising from 

legal, technological, competitive, market, 

cultural, social, and economic environments. 

whether international, national, regional or 

local. 

NOTE 3: 

Understanding the internal context can be 

facilitated by considering issues related to 

values, culture knowledge and performance of 

the organization. 

4.2 Understanding the needs and 
expectations of interested parties 

Due to their impact or potential impact on the 
organisation’s ability to consistently provide 
products and services that meet customer and 
applicable statutory and regulatory 
requirements, the organization shall determine: 

a) the interested parties that are relevant to 
the quality management system; 

b) the requirements of these interested 
parties that are relevant to the quality 
management system. 

The organization shall monitor and review the 
information about these interested parties and 
their relevant requirements. 

4.3 Determining the scope of the quality 
management system 

The organization shall determine the 
boundaries and applicability of the quality 
management system to establish its scope. 
When determining this scope, the 
organization shall consider: 

a) the external and internal issues referred 
to in 4.1; 

b) the requirements of relevant interested 
parties referred to in 4.2; 

c) the products and services of the 
organization. 

The organization shall apply all the 
requirements of this International 
Standard if they are applicable within the 
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determined scope of its quality 
management system. 

The scope of the organization’s quality 
management system shall be available 
and be maintained as documented 
information. The scope shall state the 
types of products and services covered, 
and provide justification for any 
requirement of this International 
Standard that the organization 
determines is not applicable to the scope 
of its quality management system. 
Conformity to this International Standard 
may only be claimed if the requirements 
determined as not being applicable do 
not affect the organization’s ability or 
responsibility to ensure the conformity of 
its products and services and the 
enhancement of customer satisfaction. 
4.4 Quality management system and its 
processes 
4.4.1 

The organization shall establish, 
implement, maintain and continually 
improve a quality management system, 
including the processes needed and 
their interactions, in accordance with the 
requirements of this International 
Standard. 

The organization shall determine the 

processes needed for the quality management 

system and their application throughout the 

organization and shall: 

a) determine the inputs required and the 
outputs expected from these processes; 

b) determine the sequence and interaction of 
these processes; 

c) determine and apply the criteria and 
methods, (including monitoring, 
measurements and related performance 
indicators) needed to ensure the effective 
operation, and control of these processes; 

d) determine the resources needed and ensure 
their availability; 

e) assign the responsibilities and authorities for 
these processes; 

f) address the risks and opportunities in 
accordance with the requirements of 6.1, 

g) evaluate these processes and implement 
any changes needed to ensure that these 
processes achieve their intended results; 

h) improve the processes and the quality 
management system. 
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4.4.2 

To the extent necessary, the organization 

shall: 

a) maintain documented information to 
support the operation of its processes; 

b) retain documented information to have 
confidence that the processes are being 
carried out as planned. 
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5 Leadership 

5.1 Leadership and commitment 

5.1.1 General 

Top management shall demonstrate leadership 

and commitment with respect to the quality 

management system by: 

a) taking accountability of the effectiveness of 
the quality management system; 

b) ensuring that the quality policy and quality 
objectives are established for the quality 
management system and are compatible 
with the strategic direction and the context 
of the organization; 

c) ensuring that the quality policy is 
communicated, understood and applied 
within the organization; 

d) ensuring the integration of the quality 
management system requirements into the 
organization’s business processes; 

e) promoting the use of the process 
approach and risk-based thinking; 

f) ensuring that the resources needed for the 
quality management system are available; 

g) communicating the importance of effective 
quality management and of conforming to 
the quality management system 
requirements; 

h) engaging, directing and supporting persons 
to contribute to the effectiveness of the 
quality management system; 

j) promoting continual improvement; 

k) supporting other relevant management roles 
to demonstrate their leadership as it applies 
to their areas of responsibility. 


NOTE: 

Reference to “business” in this International 

Standard can be interpreted broadly to mean 

those activities that are core to the purposes of 

the organization’s existence; whether the 

organization is public, private, for profit or not 

for profit. 

5.1.2 Customer focus 

Top management shall demonstrate leadership 

and commitment with respect to customer 

focus by ensuring that: 

a) customer requirements and applicable 
statutory and regulatory requirements are 
determined, understood and 
consistently met; 

b) the risks and opportunities that can affect 
conformity of products and services and the 
ability to enhance customer satisfaction are 
determined and addressed; 

c) the focus on enhancing customer 
satisfaction is maintained. 
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5.2 Policy 

5.2.1 Establishing the quality policy 

Top management shall establish, implement 
and maintain a quality policy that: 

a) is appropriate to the purpose and context 
of the organization and supports its 
strategic direction; 

b) provides a framework for setting quality 
objectives; 

c) includes a commitment to satisfy 
applicable requirements; 

d) includes a commitment to continual 
improvement of the quality management 
system. 

5.2.2 Communicating the quality policy 

The quality policy shall: 

a) be available and be maintained as 
documented information; 

b) be communicated, understood and applied 
within the organization; 

c) be available to relevant interested parties, 
as appropriate. 

5.3 Organizational roles, responsibilities 
and authorities 

Top management shall ensure that the 
responsibilities and authorities for relevant 
roles are assigned, communicated and 
understood within the organization. 

Top management shall assign the 
responsibility and authority for: 

a) ensuring that the quality management 
system conforms to the requirements of 
this International Standard; 

b) ensuring that the processes are delivering 
their intended outputs; 

c) reporting on the performance of the quality 
management system and on opportunities 
for improvement (see 10.1), in particular 
to top; 

d) ensuring the promotion of customer focus 
throughout the organization; 

e) ensuring that the integrity of the quality 
management system is maintained when 
changes to the quality management 
system are planned and implemented. 
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6 Planning 


JajlaJeJiJI -1 


6.1 Actions to address risks and 
opportunities 

6.1.1 When planning for the quality 
management system, the organization shall 
consider the issues referred to in 4.1 and the 
requirements referred to in 4.2 and determine 
the risks and opportunities that need to be 
addressed to: 

a) give assurance that the quality 
management system can achieve its 
intended result(s); 

b) enhance desirable effects; 

c) prevent, or reduce, undesired effects; 

d) achieve improvement. 

6.1.2 The organization shall plan: 

a) actions to address these risks and 
opportunities; 

b) how to: 

1) integrate and implement the actions 
into its quality management system 
processes (see 4.4); 

2) evaluate the effectiveness of these 
actions. 

Actions taken to address risks and 
opportunities shall be proportionate to the 
potential impact on the conformity of products 
and services. 

NOTE 1 

Options to address risks and opportunities 

can include: avoiding risk, taking risk in order 

to pursue an opportunity, eliminating the risk 

source, changing the likelihood or 

consequences, sharing the risk, or retaining 

risk by informed decision. 
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NOTE 2 

Opportunities can lead to the adoption of 

new practices, launching new products, 

opening new markets, addressing new 

customers, building partnerships, using 

new technology and other desirable and 

viable possibilities to address the 

organization’s or its customers’ needs. 

6.2 Quality objectives and planning to 
achieve them 

6.2.1 The organization shall establish quality 
objectives at relevant functions, levels and 
processes needed for the quality 
management system. 

The quality objectives shall: 

a) be consistent with the quality policy, 

b) be measurable; 

c) take into account applicable requirements; 

d) be relevant to conformity of products and 
services and the enhancement of 
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customer satisfaction; 

e) be monitored; 

f) be communicated; 

g) be updated as appropriate. 

The organization shall maintain documented 
information on the quality objectives. 

6.2.2 When planning how to achieve its quality 

objectives, the organization shall determine: 

a) what will be done; 

b) what resources will be required; 

c) who will be responsible; 

d) when it will be completed; 

e) how the results will be evaluated. 

6.3 Planning of changes 

Where the organization determines the need 
for change to the quality management system 
the change shall be carried out in a planned 
manner, (see 4.4) 

The organization shall consider: 

a) the purpose of the change and any of its 
potential consequences; 

b) the integrity of the quality management 
system; 

c) the availability of resources; 

d) the allocation or reallocation of 
responsibilities and authorities. 
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7 Support 

7.1 Resources 

7.1.1 General 

The organization shall determine and provide 
the resources needed for the establishment, 
implementation, maintenance and continual 
improvement of the quality management 
system. 

The organization shall consider: 

a) the capabilities of, and constraints on, 
existing internal resources; 

b) what needs to be obtained from external 
providers. 

7.1.2 People 

The organization shall determine and provide 
the persons necessary for the effective 
implementation of its quality management 
system and for the operation and control of its 
processes. 

7.1.3 Infrastructure 

The organization shall determine, provide 
and maintain the infrastructure for the 
operation of its processes to achieve 
conformity of products and services. 

NOTE 

Infrastructure can include: 

a) buildings and associated utilities; 

b) equipment including hardware and software; 

c) transportation resources; 

d) information and communication technology. 

7.1.4 Environment for the operation of 
processes 

The organization shall determine, provide 
and maintain the environment necessary for 
the operation of its processes and to achieve 
conformity of products and services. 

NOTE 

A suitable environment can be a combination 
of human and physical factors, such as: 

a) social (e.g. non-discriminatory, calm, non- 
confrontational); 

b) psychological (e.g. stress-reducing, 
burnout prevention, emotionally protective); 

c) physical (e.g. temperature, heat, humidity, 
light, airflow, hygiene, noise). 

These factors can differ substantially 
depending on the products and services 
provided. 
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7.1.5 Monitoring and measuring resources 
7.1.5.1 General 

The organization shall determine and 
provide the resources needed to ensure 
valid and reliable results when 
monitoring or measuring is used to verify 
the conformity of products and services 
to requirements. 

The organization shall ensure that the 
resources provided: 

a) are suitable for the specific type of 
monitoring and measurement activities 
being undertaken; 

b) are maintained to ensure their continuing 
fitness for their purpose. 

The organization shall retain appropriate 
documented information as evidence of 
fitness for purpose of monitoring and 
measurement resources. 

7.1.5.2 Measurement traceability 

When measurement traceability is a 

requirement, or is considered by the 

organization to be an essential 

part of providing confidence in the 

validity of measurement results, 

measuring equipment shall be: 

□ □verified or calibrated at specified intervals 
or prior to use against measurement 
standards traceable to international or 
national measurement standards. Where 
no such standards exist, the basis used 
for calibration or verification shall be 
retained as documented information; 

identified in order to determine their 
calibration status; 

safeguarded from adjustments, 
damage or deterioration that would 
invalidate the calibration status and 
subsequent measurement results. 

The organization shall determine if the 
validity of previous measurement results has 
been adversely affected when measuring 
equipment is found to be unfit for its intended 
purpose, and shall take appropriate action as 
necessary. 
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7.1.6 Organizational knowledge 

The organization shall determine the 
knowledge necessary for the operation of its 
processes and to achieve conformity of 
products and services. 

This knowledge shall be maintained, and 
made available to the extent necessary. 

When addressing changing needs and 
trends, the organization shall consider its 
current knowledge and determine how to 
acquire or access the necessary additional 
knowledge and required updates. 
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/VOTE 7 

Organizational knowledge is knowledge 

specific to the organization; it is generally 

gained by experience. It is information that is 

used and shared to achieve the 

organization’s objectives. 
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NOTE 2 

Organizational knowledge can be based on:: 

a) internal sources (e.g. intellectual property; 

knowledge gained from experience; 

lessons learned from failures and 
successful projects; capturing and sharing 

undocumented knowledge and 
experience; the results of improvements in 

processes, products and services) 

b) external sources (e.g. standards, academia. 

conferences, gathering knowledge from 

customers or rexternal providers). 


r 

■Vt^C fSdjJ yj//>£<u AghiU L^jldld 
JjqJLxJI L JZa -j 

Ldjij&jJI t'yd < ^ .I S U I 

dLbbj>LjJI$ *LiZiLdJI 

/lc ZdljiseJI JaLuJIg 

.ZdLgj^eJig ZjidZLilzj LuLdJ t . l J Pru d Jt l JI xbtzjji 
subd/g ZdL* Old *Lj>)lJeJI -i_j 

Pag LjlII iZjIfiAjqdlg 4±dJjt£fy/_ TzLmgylg 

■ZrUd^iLxJ!,’ jjJ?! (TLcJtJt 


7.2 Competence 


S*U£JI Y -V 


The organization shall: 

a) determine the necessary competence of 
person(s) doing work under its control that 
affects the performance and 
effectiveness of the quality 
management system; 

b) ensure that these persons are competent 
on the basis of appropriate education, 
training, or experience; 

c) where applicable, take actions to acquire 
the necessary competence, and evaluate 
the effectiveness of the actions taken; 

d) retain appropriate documented information 
as evidence of competence. 


NOTE Applicable actions can include, for 

example, the provision of training to, the 

mentoring of, or the reassignment of currently 

employed persons; or the hiring or 

contracting of competent persons. 
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7.3 Awareness 

The organization shall ensure that persons 

doing work under the organization’s control 

shall be aware of: 

a) the quality policy; 

b) relevant quality objectives; 

c) their contribution to the effectiveness of the 
quality management system, including the 
benefits of improved quality performance; 

d) the implications of not conforming with the 

quality management system 

requirements. 
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7.4 Communication 

The organization shall determine the internal 
and external communications relevant to the 
quality management system including: 

a) on what it will communicate; 

b) when to communicate; 

c) with whom to communicate; 

d) how to communicate. 

e) who communicates 

7.5 Documented information 

7.5.1 General 

The organization’s quality management 
system shall include 

a) documented information required by this 
International Standard; 

b) documented information determined by the 
organization as being necessary for the 
effectiveness of the quality management 
system. 

NOTE The extent of documented information 

for a quality management system can differ 

from one organization to another due to: 

a) the size of organization and its type of 

activities, processes, products and 

services; 

b) the complexity of processes and their 

interactions; 

c) the competence of persons. 

7.5.2 Creating and updating 

When creating and updating documented 
information the organization shall ensure 
appropriate: 

a) identification and description (e.g. a title, 
date, author, or reference number); 

b) format (e.g. language, software version, 
graphics) and media (e.g. paper, 
electronic); 

c) review and approval for suitability and 
adequacy. 

7.5.3 Control of documented Information 

7.5.3.1 Documented information required by the 
quality management system and by this 
International Standard shall be controlled to 
ensure: 

a) it is available and suitable for use, where 
and when it is needed; 

b) it is adequately protected (e.g. from loss 
of confidentiality, improper use, or loss 
of integrity). 


CtfUaSYl / J^l^lJI 1 -V 

4_Jl> I jJI 4 oPSill 

: Sjl.il » lia-a 4_9 MjlJI Cili 

lit* -I 
.JUtfYI jCOJ JU -c_J 

IjJlJI jdjLwj 1 

^ JJ! fjA -jt 

4JLs^-l 1 CjLojJjlX I 0 -Y 

: JlZ 4aPSUL fijl.il jjI 

.4_JjjJI 4 a 4 G 1ji,I Lfcilaj <J\]I 4JLijJJ JjLsjJjlII -I 
4_jjj_*b Laljjj 4-aPS <I,I jUI 4 JLjjJ,I I -l_j 

Sijj^JI ijlil 4-J1 xQ I 

4laj>yU 

L j^ SjljJ ja lkif lZj bs! )JL3 ■ * 

£ J /jJaJ L Jj 

L,pL?eZL4§ Lgd^5JJ_ -/ 

.LtrL3j->$ 

Oj *Lm<jVI Y-o-V 

(jl u-Ocj 1 CjLaj J btXI jl *Lm<jI J_Lfc 

: 4 m 

^jjllJI JJLa £^lj-m»LLU >. J-)JiJdJI -I 

^J^ti 

Cj jl j^I j 4 JlUI (J 1a u_<-u)Ll!U -c_> 

.4-ujj\^jl jl 4_i_9jj JJLa 

.L^jLo£j 4_uu)Ll1I 4_*_>IjJJ 

uLjLqjJjlU Pi «ih r-O-V 
dS.ijjfcJI 5j1.il ^UajJ 4JL>jX! Cj Lo jJbii,I U < jcJu \-T-0-\ 

:£)Lc-^aJ 4 *]$jJI 4 a IjJ.I 

L^JlLc. 4_j-«jLLj^ 4_>Lla -I 

.L^JJ 4_>LtJI 

£jL\ a° i (Jllil (J-jj-M) ^jLc. 4_uc^t« L^l -l_) 

. L^-cljl 

^LcJLtYl^ 4 j-«>1_LU 4_»_>IjJ,I 


O'X y y 4-a -a +r) 


usamatqm@gmail.com — ^jU-Ju^ Jux. ju-o^ 4 _^>jj 


























Y. S o : ^ \ ^Vl 2 lXUJI ai^ljJU 


7.5.3.2 For the control of documented information, 
the organization shall address the following 
activities, as applicable: 

a) distribution, access, retrieval and use; 

b) storage and preservation, including 
preservation of legibility; 

c) control of changes (e.g. version control); 

d) retention and disposition. 

Documented information of external origin 
determined by the organization to be 
necessary for the planning and operation of 
the quality management system shall be 
identified as appropriate, and controlled. 
Documented information retained as 
evidence of conformity shall be protected 
from unintended alterations. 

NOTE 

Access can imply a decision regarding the 
permission to view the documented information 
only, or the permission and authority to view and 
change the documented information. 
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8 Operation 

8.1 Operational planning and control 

The organization shall plan, implement and 
control the processes, as outlined in 4.4, 
needed to meet requirements for the provision 
of products and services and to implement the 
actions determined in 6.1, by: 

a) determining requirements for the product 
and services; 

b) establishing criteria for: 

1) the processes 

2) the acceptance of products and services; 

c) determining the resources needed to 
achieve conformity to product and service 
requirements; 

d) implementing control of the processes in 
accordance with the criteria; 

e) determining, maintaining and retaining 
documented information to the extent 
necessary: 

1) to have confidence that the processes 
have been carried out as planned; 

2) to demonstrate the conformity of 
products and services to their 
requirements.. 

The output of this planning shall be suitable 
for the organization's operations. 

The organization shall control planned 
changes and review the consequences of 
unintended changes, taking action to mitigate 
any adverse effects, as necessary. 

The organization shall ensure that 
outsourced processes are controlled (see 
8.4). 

8.2 Requirements for products and 
services 

8.2.1 Customer communication 

Communication with customers shall include: 

a) providing information relating to 
products and services; 

b) handling enquiries, contracts or orders, 
including changes; 

c) obtaining customer feedback relating to 
products and services, including customer 
complaints; 

d) the handling or controlling customer 
property; 

e) establishing specific requirements for 
contingency actions, when relevant. 
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8.2.2 Determination of requirements for 
products and services. 

When determining the requirements for the 
products and services to be offered to 
customers, the organization shall ensure that: 

a) the requirements for the products and 
services are defined, including: 

1) any applicable statutory and regulatory 
requirements; 

2) those considered necessary by the 
organization; 

b) the organization can meet the claims 
for the products and services it offers. 

8.2.3 Review of requirements for products and 
services 

8.2.3.1 The organization shall ensure that it 

has the ability to meet the requirements 
for products and services to be offered 
to customers. The organization shall 
conduct a review before committing to 
supply products and services to a 
customer, to include: 

a) requirements specified by the customer, 
including the requirements for delivery 
and post-delivery activities; 

b) requirements not stated by the customer, 
but necessary for specified or intended 
use, when known; 

c) requirements specified by the organization; 

d) statutory and regulatory requirements 
applicable to the products and services; 

d) contract or order requirements differing 
from those previously expressed. 


The organization shall ensure that 
contract or order requirements differing 
from those previously defined are 
resolved. 

The customer’s requirements shall be 
confirmed by the organization before 
acceptance, when the customer does 
not provide a documented statement of 
their requirements. 

NOTE 

In some situations, such as internet sales, a formal 

review is impractical for each order. Instead, the 

review can cover relevant product information, 

such as catalogues. 


8.2.3.2 The organization shall retain 

documented information, as applicable: 

a) on the results of the review; 

b) on any new requirements for the 

products and services. 
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8.2.4 Changes to requirements for products and 
services 

The organization shall ensure that relevant 
documented information is amended, and that 
relevant persons are made aware of the changed 
requirements, when the requirements for products 
and services are changed. 

8.3 Design and development of products 
and services 
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8.3.1 General 

The organization shall establish, implement 
and maintain a design and development 
process that is appropriate to ensure the 
subsequent provision of products and 
services. 

8.3.2 Design and development planning 

In determining the stages and controls for 
design and development, the organization 
shall consider: 

a) the nature, duration and complexity of the 
design and development activities; 

b) the required process stages, including 
applicable design and development 
reviews; 

c) the required design and development 
verification and validation activities;; 

d) the responsibilities and authorities involved 
in the design and development process; 

e) the internal and external resource 
needs for the design and development 
of products and services; 

f) the need to control interfaces between 
persons involved in the design and 
development process; 

g) the need for involvement of customers 
and users in the design and 
development process; 

h) the requirements for subsequent 
provision of products and services; 

i) the level of control expected for the 

design and development process by 
customers and other relevant 
interested parties; 

j) the documented information needed to 

demonstrate that design and 
development requirements have been 
met. 

8.3.3 Design and development Inputs 

The organization shall determine the 
requirements essential for the specific 
types of products and services to be 
designed and developed. The 
organization shall consider: 

a) functional and performance requirements; 

b) information derived from previous similar 
design and development activities; 
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c) statutory and regulatory requirements; 

d) standards or codes of practice that the 
organization has committed to implement; 

e) the potential consequences of failure due 
to the nature of the products and services. 

Inputs shall be adequate for design and 
development purposes, complete, and 
unambiguous. 

Conflicts among inputs shall be resolved. 

The organization shall retain documented 
information on design and development 
inputs. 
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8.3.4 Design and development controls 

The organization shall apply controls to 

the design and development process to 

ensure that: 

a) the results to be achieved are defined; 

b) reviews are conducted to evaluate the 
ability of the results of design and 
development to meet requirements; 

c) verification activities are conducted to 
ensure that the design and development 
outputs meet the input requirements; 

d) validation activities are conducted to 
ensure that the resulting products and 
services meet the requirements for 
the specified application or intended 
use. 

8.3.5 Design and development outputs 

The organization shall ensure that design and 

development outputs: 

a) meet the input requirements for design and 
development; 

b) are adequate for the subsequent 
processes for the provision of products 
and services; 

c) include or reference monitoring and 
measuring requirements, and acceptance 
criteria, as applicable; 

d) ensure products to be produced, or 
services to be provided, are fit for 
intended purpose and their safe and 
proper use; 

e) any necessary actions are taken on 
problems determined during the 
reviews, or verification and validation 
activities; 

f) documented information of these activities 

is retained. 

NOTE Design and development reviews, 

verification and validation have distinct 

purposes. They can be conducted separately 

or in any combination, as is suitable for the 

products and services of the organization. 
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8.3.6 Design and development changes 

The organization shall identify, review 
and control changes made during, or 
subsequent to, the design and 
development of products and services, 
to the extent necessary to ensure that 
there is no adverse impact on conformity 
to requirements 
The organization shall retain 
documented information on: 

a) design and development changes; 

b) the results of reviews; 

c) the authorization of the changes; 

d) the actions taken to prevent adverse 
impacts. 

8.4 Control of externally provided products 
and services 
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8.4.1 General 

The organization shall ensure that externally 
provided processes, products, and services 
conform to requirements. 

The organization shall determine the 
controls to be applied to externally 
provided processes, products 
and services when: 

a) products and services are provided by 
external providers for incorporation into 
the organization’s own products and 
services; 

b) products and services are provided directly 
to the customer(s) by external providers 
on behalf of the organization; 

c) a process or part of a process is provided 
by an external provider as a result of a 
decision by the organization. 

The organization shall determine and apply 
criteria for the evaluation, selection, 
monitoring of performance, and re-evaluation 
of external providers, based on their ability to 
provide processes or products and services 
in accordance with requirements. 
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The organization shall retain documented 
information of these activities and any 
necessary actions arising from the 
evaluations. 

8.4.2 Type and extent of control 

The organization shall ensure that externally 
provided processes, products and services 
do not adversely affect the organization’s 
ability to consistently deliver conforming 
products and services to its customers. 

The organization shall: 
a) ensure that externally provided 

processes remain within the control of 
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its quality management system; 

b) define both the controls that it intends to 
apply to an external provider and those it 
intends to apply to the resulting output; 

c) take into consideration: 

1) the potential impact of the externally 
provided processes, products and 
services on the organization’s ability 
to consistently meet customer and 
applicable statutory and regulatory 
requirements; 

2) the effectiveness of the controls 
applied by the external provider. 

d) Determine verification or other activities 
necessary to ensure the externally 
provided processes, products and 
services meet requirements. 

8.4.3 Information for external providers 

The organization shall ensure the 
adequacy of requirements prior to their 
communication to the external provider. 
The organization shall communicate to 
external providers its requirements for: 

a) the process, products and services to be 
provided; 

b) approval of: 

1) products and services; 

2) methods, processes and equipment; 

3) the release of products and services; 

c) competence, including any required 
qualification of persons; 

d) the external providers’ interactions with the 
organization; 

e) control and monitoring of the external 
providers’ performance to be applied 
by the organization; 

f) verification or validation activities that 

the organization, or its customer, 
intends to perform at the external 
providers’ premises. 

8.5 Production and service provision 

8.5.1 Control of production and service 
provision 

The organization shall implement 
production and service provision under 
controlled conditions. 

Controlled conditions shall include, as 
applicable: 

a) the availability of documented information 
that defines: 

1) the characteristics of the products 
to be produced, the services to be 
provided, or the activities to be 
performed; 

2) the results to be achieved; 

b) the availability and use of suitable 
monitoring and measuring resources;; 
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c) the implementation of monitoring and 
measurement activities at appropriate 
stages to verify that criteria for control of 
processes or outputs, and acceptance 
criteria for products and services, have 
been met; 

d) the use of suitable infrastructure and 
environment for the operation of 
processes; 

e) the appointment of competent 
persons, including any required 
qualification; 

f) the validation, and periodic revalidation, of 

the ability to achieve planned results of 
the processes for production and service 
provision, where the resulting output 
cannot be verified by subsequent 
monitoring or measurement; 

g) the implementation of actions to 
prevent human error; 

h) the implementation of release, delivery 
and post-delivery activities. 

8.5.2 Identification and traceability 

The organization shall use suitable 
means to identify outputs when it is 
necessary to ensure the conformity of 
products and services. 

The organization shall identify the status of 
outputs with respect to monitoring and 
measurement requirements throughout 
production and service provision. 

the organization shall control the unique 
identification of the outputs, when traceability 
is a requirement, and shall retain the 
documented information necessary to enable 
traceability. 

8.5.3 Property belonging to customers or 
external providers 

The organization shall exercise care with 
property belonging to the customer or 
external providers while it is under the 
organization's control or being used by the 
organization. 

The organization shall identify, verify, protect 
and safeguard the customer’s or external 
provider’s property provided for use or 
incorporation into the products and services. 
When property of the customer or external 
provider is lost, damaged or otherwise found 
to be unsuitable for use, the organization 
shall report this to the customer or external 
provider and retain documented 
information on what has occurred. 

NOTE 

Customer property can include material, 

components, tools and equipment, customer 

premises, intellectual property and personal 

data. 
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8.5.4 Preservation 

The organization shall preserve the outputs 
during production and service provision, to 
the extent necessary to maintain conformity 
to requirements. 

NOTE 

Preservation can include identification. 

handling, contamination control, packaging, 

storage, transmission or transportation, and 

protection. 

8.5.5 Post-delivery activities 

the organization shall meet requirements for 
post-delivery activities associated with the 
products and services. 

In determining the extent of post-delivery 
activities that are required, the organisation 
shall consider: 

a) statutory and regulatory requirements 

b) the potential undesired consequences 
associated with its products and 
services; 

c) the nature, use and intended lifetime of the 
products and services; 

d) customer requirements; 

e) customer feedback. 

NOTE 

Post-delivery activities can include actions 

under warranty provisions, contractual 

obligations such as maintenance services, 

and supplementary services such as 

recycling or final disposal. 

8.5.6 Control of changes 

The organization shall review and control 
changes for production or service provision to 
the extent necessary to ensure continuing 
conformity with requirements. 

The organization shall retain documented 
information describing the results of the 
review of changes, the personnel authorizing 
the change, and any necessary actions 
arising from the review. 

8.6 Release of products and services 

The organization shall implement the planned 
arrangements at appropriate stages to verify 
that product and service requirements have 
been met. 

The release of products and services to the 
customer shall not proceed until the planned 
arrangements have been satisfactorily 
completed, unless otherwise approved by a 
relevant authority and, as applicable, by the 
customer. 

The organization shall retain 
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documented information on the release 
of products and services. The 
documented information shall include: 

a) evidence of conformity with the 
acceptance criteria; 

b) traceability to the person(s) 
authorizing the release. 

8.7 Control of nonconforming outputs 

8.7.1 

The organization shall ensure that outputs, 
that not conform to requirements are 
identified and controlled to prevent their 
unintended use or delivery. 

The organization shall take appropriate 
corrective action based on the nature of the 
nonconformity and its effect on the conformity 
of products and services. This applies also 
apply to nonconforming products and 
services detected after delivery of the 
productsm, during or after the provision of the 
service. 

The organization shall deal with 
nonconforming outputs, in one or more of the 
following ways: 

a) correction; 

b) segregation, containment, return or 
suspension of provision of products and 
services; 

c) informing the customer; 

d) obtaining authorization for acceptance 
under concession. 

Conformity to the requirements shall be 
verified when nonconforming outputs are 
corrected. 

8.7.2 

The organization shall retain documented 
information that; 

a) describes the nonconformity; 

b) describes the actions taken; 

c) describes any concessions obtained; 

d) identifies the authority deciding the 

action in respect of the 

nonconformity.. 
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9 Performance Evaluation 

9.1 Monitoring, Measurement, Analysis 
And Evaluation 

9.1.1 General 

The organization shall determine: 

a) what needs to be monitored and measured; 

b) the methods for monitoring, measurement, 
analysis and evaluation, needed to ensure 
valid results; 

c) when the monitoring and measuring shall be 
performed; 

d) when the results from monitoring and 
measurement shall be analysed and 
evaluated. 

The organization shall evaluate the 
performance and the effectiveness of the 
quality management system. 

The organization shall retain appropriate 
documented information as evidence of 
the results. 

9.1.2 Customer satisfaction 

The organization shall monitor customers’ 
perceptions of the degree to which their 
needs and expectations have been 
fulfilled. 

The organization shall determine the 
methods for obtaining, monitoring and 
reviewing this information. 

NOTE 

Examples of monitoring customer perceptions 
can include customer surveys, customer 
feedback on delivered products and services, 
meetings with customers, market-share 
analysis, compliments, warranty claims and 
dealer reports. 


9.1.3 Analysis and evaluation 

The organization shall analyse and evaluate 

appropriate data and information arising from 

monitoring and measurement. 

The output of analysis and evaluation shall be 

used to evaluate: 

a) conformity of products and services; 

b) the degree of customer satisfaction; 

c) the performance and effectiveness of the 
quality management system; 

d) If planning has been implemented 
effectively; 

e) the effectiveness of actions taken to address 
risks and opportunities; 

f) assess the performance of external 
provider(s); 

g) the need for improvements to the quality 
management system. 

NOTE 

Methods to analyse data can include statistical 

techniques. 
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9.2 Internal Audit 

9.2.1 The organization shall conduct internal 
audits at planned intervals to provide 
information on whether the quality 
management system; 

a) conforms to: 

1) the organization’s own requirements for 
its quality management system; 

2) the requirements of this International 
Standard; 

b) is effectively implemented and maintained. 

9.2.2 The organization shall: 

a) plan, establish, implement and maintain an 
audit programme(s) including the 
frequency, methods, responsibilities, 
planning requirements and reporting, which 
shall take into consideration the importance 
of the processes concerned, changes 
affecting the organisation, and the results of 
previous audits; 

b) define the audit criteria and scope for each 
audit; 

c) select auditors and conduct audits to ensure 
objectivity and the impartiality of the audit 
process; 

d) ensure that the results of the audits are 
reported to relevant management; 

e) take necessary correction and corrective 
actions without undue delay; 

f) retain documented information as evidence 
of the implementation of the audit 
programme and the audit results. 

NOTE 

See ISO 19011 for guidance. 

9.3 Management review 

9.3.1 Top management shall review the 
organization's quality management system, 
at planned intervals, to ensure its continuing 
suitability, adequacy, and effectiveness and 
alignment with the strategic direction of the 
organization. 

9.3.2 Management Review Inputs 

The management review shall be planned 
and carried out taking into consideration: 

a) the status of actions from previous 
management reviews; 

b) changes in external and internal issues 
that are relevant to the quality 
management system; 

c) information on the performance and 
effectiveness of the quality management 
system, including trends in: 

1) customer satisfaction and feedback 
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from relevant interested parties; 

2) the extent to which quality 
objectives have been met 

3) process performance and 
conformity of products and 
services; 

4) nonconformities and corrective actions; 

5) monitoring and measurement results; 

6) audit results; 

7) the performance of external providers;; 
5) issues concerning external providers 

and other relevant interested parties; 

d) adequacy of resources; 

e) the effectiveness of actions taken to 
address risks and opportunities (see 
clause 6.1); 

f) opportunities for improvement. 

9.3.3 Management review outputs 

The outputs of the management review shall 
include decisions and actions related to: 

a) opportunities for improvement; 

b) any need for changes to the quality 
management system; 

c) resources needed 

The organization shall retain documented 
information as evidence of the results of 
management reviews. 
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10 Improvement 

10.1 General 

The organization shall determine and select 
opportunities for improvement and implement 
necessary actions to meet customer 
requirements and enhance customer 
satisfaction. 

These shall include: 

a) improving products and services to 
meet requirements as well as to 
address future needs and 
expectations; 

b) correcting, preventing or reducing 
undesired effects; 

c) improving the performance and 
effectiveness of the quality 
management system. 

NOTE 

Examples of improvement can include 

correction, corrective action , continual 

improvement, breakthrough change, 

innovation and re-organization. 
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10.2 Nonconformity and corrective action 

10.2.1 When a nonconformity occurs, including 
any arising from complaints, the organization 
shall: 

a) react to the nonconformity, and as 
applicable: 

1) take action to control and correct it; 

2) deal with the consequences; 

b) evaluate the need for action to eliminate 
the cause(s) of the nonconformity, in order 
that it does not recur or occur elsewhere, 
by: 

1) reviewing andanalyzing the 
nonconformity; 

2) determining the causes of the 
nonconformity; 

3) determining if similar nonconformities 
exist, or could potentially occur; 

c) implement any action needed; 

d) review the effectiveness of any corrective 
action taken; 

e) update risks and opportunities 
determined during planning, if 
necessary; 

f) make changes to the quality management 

system, if necessary. 

Corrective actions shall be appropriate to the 
effects of the nonconformities encountered. 
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10.2.2 The organization shall retain documented .-, 1 ^ 1 .,, ui^vi a,un i t-t-u 


information as evidence of: 


•J* 


a) the nature of the nonconformities and any a^jtLaJLI A_Li. 4 j L Lx b -I 


subsequent actions taken; 
b) the results of any corrective action. 

10.3 Continual improvement 



The organization shall continually improve ^ ,>**3 J ^0.1 J* ^ 

the suitability, adequacy, and effectiveness of 
the quality management system. 

The organization shall consider the outputs of j.i~-n UjLitl j ^ pi a,um 

analysis and evaluation, and the outputs from " . 

management review, to dtermine if there are - u |*±±£ub 

needs or opportunities that shall be ^ (.y*£ 3 \ ijL»Li»| JLus cuIS' 

addressed as part of continual improvement. 
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Annex A 

(informative) 

Clarification of new structure, 
terminology and concepts 
A.l Structure and terminology 

The clause structure and some of the 
terminology of this International Standard, in 
comparison with ISO 9001:2008, have been 
changed to improve alignment with other 
management systems standards. 

The consequent changes in the structure and 
terminology do not need to be reflected in the 
documentation of an organization’s quality 
management system. 

The structure of clauses is intended to 
provide a coherent presentation of 
requirements rather than a model for 
documenting an organization’s policies, 
objectives and processes. There is no 
requirement for the structure of an 
organization's quality management system 
documentation to mirror that of this 
International Standard. 

There is no requirement for the terms used 
by an organization to be replaced by the 
terms used in this International Standard to 
specify quality management system 
requirements. Organizations can choose to 
use terms which suit their operations (for 
example: using 'records’, 'documentation', 
'protocols’, etc. rather than “documented 
information’; or 'supplier’, 'partner’, vendor 
etc. rather than 'external provider’). 

Table B.l — Major differences in terminology 
between ISO 9001:2008 and ISO 9001:2015 
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A.2 Products and services 

ISO 9001:2008 used the term “product’ to 
include all output categories. This International 
Standard uses “products and services”. The 
term “products and services” includes all 
output categories (hardware, services, 
software and processed materials). 

The specific inclusion of “services” is intended 
to highlight the differences between products 
and services in the application of some 
requirements. The characteristic of services is 
that at least part of the output is realised at the 
interface with the customer. This means, for 
example, that conformity to requirements 
cannot necessarily be confirmed before service 
delivery. 

In most cases, the terms “products” and 
“services” are used together. Most outputs that 
organizations provide to customers, or are 
supplied to them by external providers, include 
both products and services. The organization 
needs to take into account where, for example, 
a tangible product has some associated 
intangible service or an intangible service has 
some associated tangible product. 

A.3 Context of the organization 

There are two new clauses relating to the 
context of the organization, 4.1 Understanding 
the organization and its context and 4.2 
Understanding the needs and expectations of 
interested parties. Together these clauses 
require the organization to determine the 
issues and requirements that can impact on 
the planning of the quality management 
system. 

The titles of clauses 4.1 and 4.2 provide for 
alignment with other management system 
standards. They do not imply extension of 
quality management system requirements 
beyond the Scope (Clause 1) of this 
International Standard. 

The Scope states, in part, that this 
International Standard is applicable where an 
organization needs to demonstrate its ability to 
consistently provide products and services that 
meet customer and applicable statutory and 
regulatory requirements and aims to enhance 
customer satisfaction. No requirement of this 
International Standard can be interpreted as 
extending that applicability without the 
agreement of the organization. 
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There is no requirement in this International 
Standard for the organization to consider 
interested parties which have been determined 
by the organization not to be relevant to its 
quality management system. Similarly, there is 
no requirement to address a particular 
requirement of a relevant interested party if the 
organization considers that the requirement is 
not relevant. Determining what is relevant or 
not relevant is dependent on whether or not it 
has an impact on the organization’s ability to 
consistently provide products and services that 
meet customer and applicable statutory and 
regulatory requirements or the organization’s 
aim to enhance customer satisfaction. 

The organization can decide to determine 
additional needs and expectations that will 
assist it to meet its quality objectives. However, 
it is at the organization’s discretion whether or 
not to accept additional requirements to satisfy 
interested parties beyond what is required by 
this International Standard. 

A.4 Risk-based approach 

This International Standard requires the 
organization to understand its context (see 
clause 4.1) and determine the risks and 
opportunities that need to be addressed (see 
clause 6.1). 

One of the key purposes of a quality 
management system is to act as a preventive 
tool. Consequently, this International Standard 
does not have a separate clause or sub-clause 
titled 'Preventive action’. The concept of 
preventive action is expressed through a risk- 
based approach to formulating quality 
management system requirements. 

The risk-based approach to drafting this 
International Standard has facilitated some 
reduction in prescriptive requirements and their 
replacement by performance-based 
requirements. 

Although risks and opportunities have to be 
determined and addressed, there is no 
requirement for formal risk management or a 
documented risk management process. 

A.5 Applicability 

This International Standard no longer makes 
specific reference to 'exclusions' when 
determining the applicability of its requirements 
to the organization’s quality management 
system. However, it is recognised that an 
organization might need to review the 
applicability of requirements due to the size of 
the organization, the management model it 
adopts, the range of the organization’s 
activities, and the nature of the risks and 
opportunities it encounters. 
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Where a requirement can be applied within the 
scope of its quality management system, the 
organization cannot decide that it is not 
applicable. Where a requirement cannot be 
applied (for example where the relevant 
process is not carried out) the organization can 
determine that the requirement is not 
applicable. However, this non-applicability 
cannot be allowed to result in failure to achieve 
conformity of products and services or to meet 
the organization’s aim to enhance customer 
satisfaction. 

A.6 Documented information 

As part of the alignment with other 
management system standards a common 
clause on 'Documented Information' has been 
adopted without significant change or addition 
(see 7.5). Where appropriate, text elsewhere in 
this International Standard has been aligned 
with its requirements. Consequently, the terms 
“documented procedure” and “record” have 
both been replaced throughout the 
requirements text by “documented 
information”. 

Where ISO 9001:2008 would have referred to 
documented procedures (e.g. to define, control 
or support a process) this is now expressed as 
a requirement to maintain documented 
information. 

Where ISO 9001:2008 would have referred to 
records this is now expressed as a 
requirement to retain documented information. 

A.7 Organisational knowledge 

Clause 7.1.5 Organisational knowledge 
addresses the need to determine and maintain 
the knowledge obtained by the organization, 
including by its personnel, to ensure that it can 
achieve conformity of products and services. 
The process for considering and controlling 
past, existing and additional knowledge needs 
to take account of the organization’s context, 
including its size and complexity, the risks and 
opportunities it needs to address, and the need 
for accessibility of knowledge. The balance 
between knowledge held by competent people 
and knowledge made available by other means 
is at the discretion of the organization, 
provided that conformity of products and 
services can be achieved. 

A.8 Control of externally provided products 
and services 

Clause 8.4 Control of externally provided 
products and services addresses all forms of 
external provision, whether it is by purchasing 
from a supplier, through an arrangement with 
an associate company, through the 
outsourcing of processes and functions of the 
organization or by any other means. 
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The organization is required to take a risk- ^Lul JJ a,un i 

based approach to determine the type and 

extent of controls appropriate to particular V“LlU £>> ajuai! 

external providers and externally provided .L»jL> 13- 

products and services. 
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Annex B 

(informative) 

Quality management principles 

B.l Introduction 

This document introduces the seven quality 
management principles on which the ISO 
portfolio of quality management system 
standards are based. 

The principles were developed and updated 
by international experts of ISO/TC 176. 

This annex provides a “statement” describing 
each principle and a “rationale” explaining 
why an organization should address the 
principle. 

B.2 QMP 1 - Customer Focus 

a) Statement 

The primary focus of quality management is 
to meet customer requirements and to 
strive to exceed customer expectations. 

b) Rationale 

Sustained success is achieved when an 
organization attracts and retains the 
confidence of customers and other 
interested parties on whom it depends. 
Every aspect of customer interaction 
provides an opportunity to create more 
value for the customer. Understanding 
current and future needs of customers and 
other interested parties contributes to 
sustained success of an organization. 

B.3 QMP 2 - Leadership 

a) Statement 

Leaders at all levels establish unity of 
purpose and direction and create conditions 
in which people are engaged in achieving 
the quality objectives of the organization. 

b) Rationale 

Creation of unity of purpose, direction and 
engagement enable an organization to align 
its strategies, policies, processes and 
resources to achieve its objectives. 

B.4 QMP 3 - Engagement of People 

a) Statement 

It is essential for the organization that all 
people are competent, empowered and 
engaged in delivering value. 

Competent, empowered and engaged 
people throughout the organization 
enhance its capability to create value. 
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b) Rationale 

To manage an organization effectively and 
efficiently, it is important to involve all 
people at all levels and to respect them as 
individuals. Recognition, empowerment and 
enhancement of skills and knowledge 
facilitate the engagement of people in 
achieving the objectives of the organization. 
B.5 QMP 4 - Process Approach 

a) Statement 

Consistent and predictable results are 
achieved more effectively and efficiently 
when activities are understood and 
managed as interrelated processes that 
function as a coherent system. 

b) Rationale 

The quality management system is 
composed of interrelated processes. 
Understanding how results are produced by 
this system, including all its processes, 
resources, controls and interactions, allows 
the organization to optimize its 
performance. 

B.6 QMP 5 - Improvement 

a) Statement 

Successful organizations have an ongoing 
focus on improvement. 

b) Rationale 

Improvement is essential for an 
organization to maintain current levels of 
performance, to react to changes in its 
internal and external conditions and to 
create new opportunities. 

B.7 QMP 6 - Evidence-based Decision 
Making 

a) Statement 

Decisions based on the analysis and 
evaluation of data and information are more 
likely to produce desired results. 

b) Rationale 

Decision-making can be a complex 
process, and it always involves some 
uncertainty. It often involves multiple types 
and sources of inputs, as well as their 
interpretation, which can be subjective. It is 
important to understand cause and effect 
relationships and potential unintended 
consequences. Facts, evidence and data 
analysis lead to greater objectivity and 
confidence in decisions made. 
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B.8 QMP 7 - Relationship Management 

a) Statement 

For sustained success, organizations 
manage their relationships with interested 
parties, such as suppliers. 

b) Rationale 

Interested parties influence the 
performance of an organization. Sustained 
success is more likely to be achieved when 
an organization manages relationships with 
its interested parties to optimize their impact 
on its performance. Relationship 
management with its supplier and partner 
network is often of particular importance. 
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Annex C 
(informative) 

The ISO 10000 portfolio of quality 

management standards 

The International Standards (and other ISO 
deliverables) described in this annex have been 
produced as part of the ISO 10000 portfolio of 
quality management standards by ISO's Technical 
Committee ISO/TC 176. These International 
Standards can provide assistance to organizations 
when they are establishing or seeking to improve 
their quality management systems, their processes 
or their activities. 

Table C.1 shows the relationship between these 
standards and the pertinent clauses of this 
International Standard. 

ISO 10001 Customer satisfaction - Guidelines for 
codes of conduct provides guidance to an 
organization in determining that its 
customer satisfaction provisions meet 
customer needs and expectations. Its 
use can enhance customer confidence in 
an organization and improve customer 
understanding of what to expect from an 
organization, thereby reducing the 
likelihood of misunderstandings and 
complaints. 

ISO 10002 Customer satisfaction - Guidelines for 
handling complaints provides guidance on 
the process of handling complaints by 
recognizing and addressing the needs 
and expectations of complainants and 
resolving any complaints received. It 
provides an open, effective and easy-to- 
use complaints process including 

personnel training. It also provides 
guidance for small businesses. 

ISO 10003 Customer satisfaction - Guidelines for 
external dispute resolution provides 

guidance for effective and efficient 
external dispute resolution for product- 
related complaints. Dispute resolution 
gives an avenue of redress when 
organizations do not remedy a complaint 
internally. Most complaints can be 

resolved successfully within the 
organization, without adversarial 
procedures. 

ISO 10004 Guidelines for monitoring and measuring 
customer satisfaction provides guidelines 
for actions to enhance customer 

satisfaction and to identify opportunities 
for improvement of products, processes 
and attributes that are valued by 
customers. Such actions can strengthen 
customer loyalty and help retain 
customers. 
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ISO 10005 Guidelines for quality plans provides 
guidance on establishing and using 
quality plans as a means of relating 
requirements of the process, product, 
project or contract, to work methods and 
practices that support product 
realization. Benefits of establishing a 
quality plan are increased confidence 
that requirements will be met, that 
processes are in control, and the 
motivation that this can give to those 
involved. 

ISO 10006 Guidelines for quality management in 
projects are applicable to projects from 
the small to large, from simple to 
complex, from an individual project to 
being part of a portfolio of projects. They 
are to be used by personnel managing 
projects and who need to ensure that 
their organization is applying the 
practices contained in the ISO portfolio 
of quality management system 
standards. 

ISO 10007 Guidelines for configuration management 
is to assist organizations applying 
configuration management for the 
technical and administrative direction 
over the life cycle of a product. 
Configuration management can be used 
to meet the product identification and 
traceability requirements specified in ISO 
9001. 

ISO 10008 Customer satisfaction — Guidelines for 

business-to-consumer electronic commerce 
transactions gives guidance on how 
organizations can implement an effective 
and efficient business 
to-consumer electronic commerce 
transaction (B2C ECT) system and 
thereby provide a basis for consumers to 
have increased confidence in B2C ECTs; 
enhance the ability of organizations to 
satisfy consumers; and help reduce 
complaints and disputes. 

ISO 10012 Guidance for the management of 
measurement processes provides guidance 
for the management of measurement 
processes and metrological confirmation 
of measuring equipment used to support 
and demonstrate compliance with 
metrological requirements. It specifies 
quality management requirements of a 
measurement management system to 
ensure metrological requirements are 
met. 

ISO/TR 10013 Guidelines for quality management 
system documentation provides guidelines 
for the development and maintenance of 
the documentation necessary for a 
quality management system. This 
Technical Report may be used to 
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document management systems other 
than that of ISO portfolio of quality 
management system standards, for 
example environmental management 
systems and safety management 
systems. 

ISO 10014 Guidelines for realizing financial and 
economic benefits is addressed to top 
management. It provides guidelines for 
realizing financial and economic benefits 
through the application of quality 
management principles. It facilitates 
application of management principles 
and selection of methods and tools that 
enable the sustainable success of an 
organization. 

ISO 10015 Guidelines for training provides 
guidelines to assist organizations and 
addressing issues related to training. It 
may be applied whenever guidance is 
required to interpret references to 
"education" and "training" within the ISO 
portfolio of quality management system 
standards. Any reference to "training" 
includes all types of education and 
training. 

ISO 10017 Guidance on statistical techniques 
explains statistical techniques which 
follow from the variability that can be 
observed in the behaviour and outcome 
of processes, even under conditions of 
apparent stability. Statistical techniques 
allow better use of available data to 
assist in decision making, and thereby 
help to continually improve the quality of 
products and processes to achieve 
customer satisfaction. 

ISO 10018 Guidelines on people involvement and 
competence provides guidelines which 
influence people involvement and 
competence. A quality management 
system depends on the involvement of 
competent people and that they are 
introduced and integrated into the 
organization. It is critical to identify, 
develop and evaluate the knowledge, 
skills, behaviour and work environment 
required. 

ISO 10019 Guidelines for the selection of quality 
management system consultants provides 
guidance for the selection of quality 
management system consultants and the 
use of their services. It gives guidance 
on the process for evaluating the 
competence of a quality management 
system consultant and provides 
confidence that the organization's needs 
and expectations for the consultant's 
services will be met. 
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ISO 19011 Guidelines for auditing management 
systems provides guidance on the 
management of an audit programme, on 
the planning and conducting of an audit 
of the management system, as well as 
on the competence and evaluation of an 
auditor and an audit team. It is intended 
to apply to auditors, organizations 
implementing management systems, and 
organizations needing to conduct audits 
of management systems. 
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Table C.l - The relationship of other ISO quality management and quality management system 
standards (and other deliverables) to the clauses of ISO 9001 


ISO 9001 
Caluse No. 

4 

5 

6 

7 

8 

9 

10 

ISO 9000 

All 

All 

All 

All 

All 

All 

All 

ISO 9004 

All 

All 

All 

All 

All 

All 

All 

ISO 10001 





8.2.4 

8.5.1 

9.1.2 


ISO 10002 





8.2.4 

9.1.2 


ISO 10003 






9.1.2 


ISO 10004 






9.1.1 


ISO 10005 


5.3 

6.1,6.2 

All 

All 

9.1 

10.2 

ISO 10006 

All 

All 

All 

All 

All 

All 

All 

ISO 10007 





8.4.4 



ISO 10008 

All 

All 

All 

All 

All 

All 

All 

ISO 10012 




7.1.4 




ISO 10013 




7.1.5 




ISO 10014 

All 

All 

All 

All 

All 

All 

All 

ISO 10015 




7.2 




ISO 10017 



6.1 

7.1.5 


9.1 


ISO 10017 

All 

All 

All 

All 

All 

All 

All 

ISO 10019 





8.4 



ISO 19011 






9.2 


NOTE Where specific sub-clauses have not been cited, and instead "All" has been 
shown, then this indicates that all the sub-clauses to that particular ISO 9001 clause 
are related to the cross referenced standard.. 
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ISO/DIS 9001 (2015) 

ISO 9001:2008 

»jijyi AjLi.1 ja y.y.h 

AjlxIjaII Y-"Y.® 

JjMI Y-V 

JjIjaII ajlJ) -"Y 

fl* Y-Y-V 

(JljflVl) 4j>bil Y-Y-V 

jjSjj Y -"Y 

ill jl 

ftfliSJt Y.V 

Ajj-uull Y 

ftfUSJI Y.V 

f\£. Y - Y _ 1 

ftflisll Y-V 

ajc.j^i r.v 

Ajfrjjllj uujJaJIj afU£ll Y-Y.'Y 

Jbiabll Abull Y-Y-V 

4jiab]| Aujbl Y'-'Y 

uiblaxJ) (Jj» ifriY 4_ajiU! £. Y -V 

J^xJ) 4 Jjj £ _“V 

JjLuuit -A 

(jAijLuai S \jJl -V 

JjLulUI Jij.Jij hiJr^" Y -A 


CjLaiiJlj biNluYI tlibUala Jj-lftJi Y-A 

JaaxJLi 4jab jaII ljUIaxJI Y-V 

uibaAiJlj tbl■^' iuUj JiiUJ) iblj CibUaUt JjAaj Y-Y-A 

gllbb 4jaijj^il (jUllalbl JjAxj Y- Y-V 

uibaAiJl j tillabiaJb SiiUJ) ib|j CiUHaliJ) 4 jlxI ja Y-Y-A 

JCjIaILj AjfcUJI ib|j (jUllalb) AjlxIja Y-Y-V 

Juaxlb JLusjVI Y-Y-A 

Jj-xJb JLuaiVI r-Y-V 

Cd-aAiJlj tbLaabJI Jjjjj ft.A 

jjjiaoJIj fJAA*ul\ r.v 

bibs-liJlj CjLabibl jjjJajj juuuau Y-A 

Y.r.A 

Y-T-A 

1 ^ \ mY m^f 

jjjJaoJIj Ciiliia Y"-Y"-A 

jjjJaallj ■>j«<rt'iYt ibiLklA Y-Y-V 

jjjJaollj bilx jx-a ft-Y-A 

jj^jlajllj ^uAuabll bilxjiu Y-Y-V 

jjjJajJlj Jauba t-Y*-A 

jjjlajllj ^jAuajII AjlxI ja 1-Y-V 

jjjJaallj Jauba £-Y-A 

^aaa£lA\ ja (jAaall ft-Y-V 

jjjJaallj Jauba £-Y-A 

jjjlajllj Jbufrl "Y-Y-V 

jjjlajllj "Y-Y-A 

jjjiajllj ^jlc- (biib^*j]| Ja.ua V-Y-V 

ba.,jLi »JjjuJ) biUlftJlj Cilabib) Jauba £ -A 

bibjluLaJI £ - V 

Y - £-A 

^jYaJI (jj iblJjjjjJl Jauba ^Iaj Y-£-A 

bibjluLaJI 4_i.bc. Y - £ -V 

jjJ j_>a 11 UjLajluiil Y-£-A 

bibjluLaJI UjLajJxa Y-£-V 

tbU-lUlj ibjlabib) (jfr jiVI ‘Y-A 

ftl jIulaJI biLablaJI jya Y-£-V 
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ISO/DIS 9001 (2015) 

ISO 9001:2008 

UjlaAaJI ^jAAjj ^UiV) Jjjjj ®-A 

CilaAaJlj CjLaaiaJl Ajjjj #-V 

AjLaAaJl ^jASjj ^LuVI Jauua \ -*-A 

AjjjjJI Aju La 4hitni ®-0-A 

AjlaAaJl ^jAAjj ^HiVI Jauua 1 -®-V 

CjLsAaJl ^jAAjj ^UuVI JajjJa 1-®-A 

UjUaUI ^jaajj jrLLVI cjULsfr aLu& 1 t-s.V 

Jjjattl t-®-A 

JjjjIIj jjAajll 1“-®-V 

(jJAajlaJI jJJjjaJlj fvLaxJI i-'Kl'.. V-O-A 

JuaxJ) C 1 IISI 4 A i-®-V 

Mail i-0-A 

jlHaJI Jaia. «-®-V 

AjIjaII (jjIjSj Auaj 1-®-V 

(jJjj&Jlj AuaijJt sj^ai Jauua 1-V 

,-wlAISI J JjKttlj (jjbSItj AuajJI 1 -1 

(jjAuaaJ)j JjWttlj (jjUill A 

? \£. 1-1-1 

fl* 1 -A 

JjK'itlj AuajJI 1 -1 

^Uailj .lua j\\ Y-A 

Luaj Y-1-1 

f5U»JI Uaj 1-t-A 

AaliUt AiaJj^JI Y-1 

4ala.lAll AiaJj^JI r.r.A 

j.1* U.t 

LjUlaaJl o'^J Aua ij V-t-A 

CjLaAaJlj AAl aa utt (jfr JVI 1-A 

LjtaALUJl Auaj t-Y-A 

AajlkjJl Jjfr AALaAaJlj AjlauiaJl j CjULaJl CjLa,ji-a Ja.ua V-A 

ALillajJl jjfr Ajlauiail Jauua V-A 

^dJioJIj JalaoJI 1*-1-1 

CiULuJ) Jalau t-A 

(JJ4 ^ * 

jAuaaaJI s.A 

j.1* 1 - 1 . 

^aLulaIi (jj«t dUAiili r- \ * 

jaLulaII (jj4 *i v*i\l ^ ® - A 



AuJl wiia. 

(Y-1-1 t 1-1-1 jJaJi) (jajillj jJaLUJI AjAau Ljlf 1 j*j 1-1 

JLulijJl Olflja.VI r-O-A 
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ISO 9001:2008 to ISO/DIS 9001 
Correlation Matrix 


ISO 9001:2008 

ISO/DIS 9001 (2015) 

4 Quality management system 

4 Quality management system 

4.1 General requirements 

4.4 Quality management system and its processes 

4.2 Documentation requirements 

7.5 Documented information 

4.2.1 General 

7.5.1 General 

4.2.2 Quality manual 

4.3 Determining the scope of the quality 
management system 

7.5.1 General 

4.4 Quality management system and its 

Processes 

4.2.3 Control of documents 

7.5.2 Creating and updating 

7.5.3 Control of documented Information 

4.2.4 Control of records 

7.5.2 Creating and updating 

7.5.3 Control of documented Information 

5 Management responsibility 

5 Leadership 

5.1 Management commitment 

5.1 Leadership and commitment 

5.1.1 Leadership and commitment for the quality 
management system 

5.2 Customer focus 

5.1.2 Customer focus 

5.3 Quality policy 

5.2 Quality policy 

5.4 Planning 

6 Planning for the quality management system 

5.4.1 Quality objectives 

6.2 Quality objectives and planning to achieve them 

5.4.2 Quality management system planning 

6 Planning for the quality management system 

6.1 Actions to address risks and opportunities 

6.3 Planning of changes 

5.5 Responsibility, authority and communication 

5 Leadership 

5.5.1 Responsibility and authority 

5.3 Organizational roles, responsibilities and 
authorities 

5.5.2 Management representative 

Title removed 

5.3 Organizational roles, responsibilities and 
authorities 

5.5.3 Internal communication 

7.4 Communication 

5.6 Management review 

9.3 Management review 

5.6.1 General 

9.3.1 Management review 

5.6.2 Review input 

9.3.1 Management review 
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ISO 9001:2008 

ISO/DIS 9001 (2015) 

5.6.3 Review output 

9.3.2 Management review 

6 Resource management 

7.1 Resources 

6.1 Provision of resources 

7.1.1 General 

7.1.2 People 

6.2 Human resources 

Title removed 

7.2 Competence 

6.2.1 General 

7.2 Competence 

6.2.2 Competence, training and awareness 

7.2 Competence 

7.3 Awareness 

6.3 Infrastructure 

7.1.3 Infrastructure 

6.4 Work environment 

7.1.4 Environment for the operation of processes 

7 Product realization 

8 Operation 

7.1 Planning of product realization 

8.1 Operational planning and control 

7.2 Customer-related processes 

8.2 Determination of requirements for products and 
services 

7.2.1 Determination of requirements related to the 
product 

8.2.2 Determination of requirements related to 
products and services 

7.2.2 Review of requirements related to the product 

8.2.3 Review of requirements related to the products 
and services 

7.2.3 Customer communication 

8.2.1 Customer communication 

7.3 Design and development 

8.5 Production and service provision 

7.3.1 Design and development planning 

8.3 Design and development of products and 
services 

8.3.1 General 

8.3.2 Design and development planning 

7.3.2 Design and development inputs 

8.3.3 Design and development Inputs 

7.3.3 Design and development outputs 

8.3.5 Design and development outputs 

7.3.4 Design and development review 

8.3.4 Design and development controls 

7.3.5 Design and development verification 

8.3.4 Design and development controls 

7.3.6 Design and development validation 

8.3.4 Design and development controls 

7.3.7 Control of design and development changes 

8.3.6 Design and development changes 

7.4 Purchasing 

8.4 Control of externally provided products and 
services 

7.4.1 Purchasing process 

8.4.1 General 

8.4.2 Type and extent of control of external provision 

7.4.2 Purchasing information 

8.4.3 Information for external providers 

7.4.3 Verification of purchased product 

8.6 Release of products and services 
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ISO 9001:2008 

ISO/DIS 9001 (2015) 

7.5 Production and service provision 

8.5 Production and service provision 

7.5.1 Control of production and service provision 

8.5.1 Control of production and service provision 

8.5.5 Post-delivery activities 

7.5.2 Validation of processes for production and 
service provision 

8.5.1 Control of production and service provision 

7.5.3 Identification and traceability 

8.5.2 Identification and traceability 

7.5.4 Customer property 

8.5.3 Property belonging to customers or external 
providers 

7.5.5 Preservation of product 

8.5.4 Preservation 

7.6 Control of monitoring and measuring equipment 

7.1.5 Monitoring and measuring resources 

8.0 Measurement, analysis and improvement 

9.1 Monitoring, measurement, analysis and 
evaluation 

8.1 General 

9.1.1 General 

8.2 Monitoring and measurement 

9.1 Monitoring, measurement, analysis and 
evaluation 

8.2.1 Customer satisfaction 

9.1.2 Customer satisfaction 

8.2.2 Internal audit 

9.2 Internal audit 

8.2.3 Monitoring and measurement of processes 

9.1.1 General 

8.2.4 Monitoring and measurement of product 

8.6 Release of products and services 

8.3 Control of nonconforming product 

8.7 Control of nonconforming process outputs, 
products and services 

8.4 Analysis of data 

9.1.3 Analysis and evaluation 

8.5 Improvement 

10 Improvement 

8.5.1 Continual improvement 

10.1 General 

10.3 Continual Improvement 

8.5.2 Corrective action 

10.2 Nonconformity and corrective action 

8.5.3 Preventive action 

Clause removed 

6.1 Actions to address risks and opportunities (see 

6.1.1,6.1.2) 
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